Field of the Invention
The present invention generally relates to computer systems, and more particularly to methods for detection of malware in a computer system.
Related Art
Consumers and businesses increasingly rely on computers to store sensitive data. Consequently, malicious programmers seem to continually increase their efforts to gain illegitimate control and access to others' computers and sensitive data. Such malicious programmers continue to create viruses, Trojan horses, worms, and like type programs meant to compromise computer systems and sensitive data belonging to others. These malicious programs are often generally referred to as “malware.”
Malicious attacks have evolved to new levels of sophistication. Some extant Trojans facilitate HTML based attacks, for example what are known as “man in the browser” or MITB attacks. In MITB attacks, malware is installed onto a client device that alters the behavior of a web interface. The web interface may be a web browser such as Internet Explorer™, Firefox™, Chrome™, or Safari™, however similar techniques may also be applied to other types of web interfaces including specific or custom applications that provide a portal to network resources.
For example, when a user attempts to contact a known website (such as a bank website), the Trojan substitutes or alters the log in screen. A typical HTML log in screen provided by the bank site may include fields for input of the username, password and RSA token password. In one form of attack, an additional field is provided for the user to complete, for example labeled as “second token password.” The compromised interface sends the expected data and the “second token password” to the internet banking server, which can operate and perform the required transaction as normal. Likewise, all form items are sent to an address designated by the malware originator. When coupled with the now known username and password, the second token value facilitates a new fraudulent transaction with the internet banking server. This may be completed by the fraudulent party immediately after the legitimate banking transaction is completed. This is only one example of many possible HTML based attacks. The key feature is that the HTML code is altered so that the customer at a remote computer does not see the interface exactly as intended by the bank, and that the changes assist in facilitating fraud.
Thus, a need exists for systems and methods that can detect MITB-style malware.
Embodiments of the present disclosure and their advantages are best understood by referring to the detailed description that follows. It should be appreciated that like reference numerals are used to identify like elements illustrated in one or more of the figures, wherein showings therein are for purposes of illustrating embodiments of the present disclosure and not for purposes of limiting the same.